Splunk Enterprise Security

Whitelisting values for notable events

samhodgson
Path Finder

Hi All,

I've just got Enterprise Security configured and im now trying to reduce the amount of false alarms created. Im seeing a lot of low/medium urgency network notable events that I would class as normal expected network traffic. For example i've got hundreds of 'Abnormally High Number of HTTP GET Request Events' however a lot of them are for legitimate traffic.

Is possible to say do not create notable events for this event when destination = download.windowsupdate.com (or ideally a list of whitelisted URL's)?

Any help would be greatly appreciated!

Cheers

Sam

1 Solution

smoir_splunk
Splunk Employee
Splunk Employee

I'm stealing this suggestion that @starcher made in the enterprise-security channel on Slack.

You can make a lookup with the URLs that you want to ignore from the search, then use that lookup to drop them from the correlation search. This requires modifying the correlation search (I'd recommend making a new one from scratch, and disable the default one)

So, for example, the destination field has the URLs you want dropped, leave the correlation search syntax as-is, then append the lookup at the end and dropping anything that doesn't match. Because it's a URL match, it might not be as fuzzy as you want it, but it's a start.

| lookup mywhitelist destination OUTPUTNEW destination AS isFound | where isnull(isFound)

View solution in original post

smoir_splunk
Splunk Employee
Splunk Employee

I'm stealing this suggestion that @starcher made in the enterprise-security channel on Slack.

You can make a lookup with the URLs that you want to ignore from the search, then use that lookup to drop them from the correlation search. This requires modifying the correlation search (I'd recommend making a new one from scratch, and disable the default one)

So, for example, the destination field has the URLs you want dropped, leave the correlation search syntax as-is, then append the lookup at the end and dropping anything that doesn't match. Because it's a URL match, it might not be as fuzzy as you want it, but it's a start.

| lookup mywhitelist destination OUTPUTNEW destination AS isFound | where isnull(isFound)

samhodgson
Path Finder

Thanks this helps a lot 🙂

0 Karma

starcher
Influencer

part of the benefit is that if the lookup is replicated to indexers it greatly helps performance.

0 Karma
Get Updates on the Splunk Community!

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...

Enterprise Security Content Update (ESCU) | New Releases

In October, the Splunk Threat Research Team had one release of new security content via the Enterprise ...